Extracted

• • Target

    d82f9b6bf20b0c9f1a1bb556275d7b7a23544136672f51bdbe19ce4f70cd2e87

  • Size

    3.2MB

  • MD5

    17aa63a6b2374f655509ccf20a716b66

  • SHA1

    4bc36e5e10d3437fd3cf00c0f43a3c77246c7bd4

  • SHA256

    d82f9b6bf20b0c9f1a1bb556275d7b7a23544136672f51bdbe19ce4f70cd2e87

  • SHA512

    753eb6bdd1bba70fd6c3536dd720820bb5fb6e9eb11746533dced21e5974fd3962b7423fcd2379212847a0853359ec531f694d9dde2b4c0a9096c503c3e96422

  • SSDEEP

    98304:ZsBzPpbyP3yujSOGrmXD7IIuo1kkIQgtci:qhbM3yOSzQvIIuoxgth

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2